Hands-on incident response and digital forensics

Incident response and digital forensics require a balancing act to get right, but both are essential when an information security incident occurs. In this practical guide, the relationship between incident response and digital forensics is explored and you will learn how to undertake each and balance them to meet the needs of an organisation in the event of an information security incident. Best practice tips and real-life examples are included throughout. Half-Title Page......Page 9 BCS, THE CHARTERED INSTITUTE FOR IT......Page 10 Title Page......Page 12 Copyright Page......Page 14 Contents......Page 16 List of figures......Page 21 Author......Page 22 Foreword......Page 23 Acknowledgements......Page 25 Glossary......Page 26 Useful websites......Page 32 Preface......Page 34 Introduction......Page 38 Incident response......Page 39 Digital forensics......Page 44 Why both?......Page 48 Hands-on......Page 49 How this book fits in......Page 50 Part 1 Incident Response......Page 52 1. Understanding Information Security Incidents......Page 53 What is an information security incident?......Page 54 Types of incident......Page 55 Detecting security incidents......Page 70 Why do security incidents happen?......Page 80 Summary......Page 83 2. Before the Incident......Page 86 Building the incident response playbook......Page 87 Testing the playbook......Page 99 Incident planning and compliance......Page 104 Forensic readiness......Page 105 Summary......Page 108 3. The Incident Response Process......Page 110 Identification......Page 112 Containment......Page 134 Eradication......Page 143 Recovery......Page 147 Summary......Page 148 4. Things to Avoid During Incident Response......Page 151 Eradication and preservation......Page 154 An incident from an incident......Page 166 The blame game......Page 171 Summary......Page 172 5. After the Incident......Page 175 Post mortem......Page 176 Quantify the impact......Page 186 Forensics......Page 193 Summary......Page 194 6. The Business of Incident Response......Page 195 Request for proposal......Page 196 The power of PR......Page 202 Mergers and acquisitions......Page 207 Escape the technical bubble......Page 209 Incident response service providers......Page 210 Summary......Page 214 Part 2 Digital Forensics......Page 216 7. Introducing the Digital Forensics Investigation......Page 217 The investigator......Page 219 Forensics fundamentals......Page 223 Arriving at an investigation......Page 231 Investigative process......Page 233 Summary......Page 241 Crimes without borders......Page 244 Laws applicable to forensics......Page 248 Ethical considerations......Page 265 Summary......Page 266 9. Digital Forensics Tools......Page 268 Grab bag......Page 269 Forensic hardware......Page 276 Forensic software......Page 283 Summary......Page 290 10. Evidence Acquisition Basics......Page 293 The hard disk drive......Page 294 Removable media......Page 303 Processing disk images......Page 307 File systems......Page 308 Operating systems......Page 313 Files......Page 322 Analysis of artefacts......Page 325 Summary......Page 329 11. Capturing a Moving Target......Page 331 Live acquisition drivers......Page 332 Live acquisition technique......Page 342 Order of volatility......Page 343 Network forensics......Page 348 Summary......Page 355 12. Memory Forensics......Page 357 Understanding memory devices......Page 358 Capturing......Page 365 Analysis......Page 369 Summary......Page 374 13. Cloud Forensics......Page 376 Cloud computing terminology......Page 377 Acquisition in the cloud......Page 381 Container forensics......Page 394 Forensics in the cloud?......Page 396 Summary......Page 397 14. Mobile Device Forensics......Page 400 Mobile phone terminology......Page 401 Seizing mobile devices......Page 406 Acquisition types and tools......Page 412 Smartphones......Page 416 Summary......Page 419 15. Reporting and Presenting Your Findings......Page 421 Layout and content......Page 422 Audience......Page 432 Summary......Page 433 16. The Human Elements of an Investigation......Page 435 Victims......Page 436 Perpetrators......Page 445 Investigators......Page 450 Summary......Page 452 Index......Page 454 Back Cover......Page 398 Incident response is the method by which organisations take steps to identify and recover from an information security incident, with as little impact as possible on business as usual. Digital forensics is what follows - a scientific investigation into the causes of an incident with the aim of bringing the perpetrators to justice. These two disciplines have a close but complex relationship and require a balancing act to get right, but both are essential when an incident occurs. In this practical guide, the relationship between incident response and digital forensics is explored and you will learn how to undertake each and balance them to meet the needs of an organisation in the event of an information security incident. Best practice tips and real-life examples are included throughout. -- 'A great book which I could see on the shelf of any investigator or included in the book lists of digital forensic and cyber security students at university'. Dale McGleenon, UK Ministry of Defence, Cyber Forensics & Network Incident Response -- 'A fantastic summary of cyber incident response and digital forensics for existing practitioners and managers which covers the all-important impact on people! This a great book to whet the appetite of those aspiring to get into the field.' Martin Heyde , Senior Manager - Cyber Incident Response, Deloitte LLP